Php 5416 Exploit Github ✯

CVE-2012-1823 The official title: PHP-CGI Query String Parameter Parsing Arbitrary Code Execution

Decoded: This sets allow_url_include=On , auto_prepend_file to a base64-encoded PHP system command.

The script first sends a request with ?-s appended. If the response returns raw PHP code instead of executed HTML, the target is vulnerable.

http://target.com/index.php?-s This would display the source code of index.php .